Essentials e1 (1 year lifecycle) – Foundational Cybersecurity: The HITRUST Essentials (e1) assessment was introduced at the beginning of 2023.  It provides focus and assurance regarding the most critical cybersecurity controls.  It demonstrates an organization has the essential cybersecurity hygiene in place. It can be an effective assessment for smaller organizations that are beginning or developing their control environment and looking to define and implement essential, entry-level, cybersecurity practices, controls and processes to establish a baseline security and privacy framework for their organization.  It is also a good assessment consideration for organizations that have lower-risk environments. This assessment type contains 44 CSF requirements that need to be independently tested to maintain certification annually. Implemented i1 (2 year lifecycle) – Leading Practices: As an organization desires to increase the assurance they provide over their organizational security and privacy framework, the HITRUST Implemented (i1) assessment provides a moderate level of assurance that addresses cybersecurity leading practices and a broader range of active threats than an e1 assessment. Whether your organizational purpose is to mature your security program or because the growth and increased complexity of your organization requires you to implement a more robust program, the i1 Assessment may be the right assessment for you.  This assessment type contains 182 CSF requirements that need to be tested to be  certified in Year 1.  In Year 2, there is a rapid re-certification, which allows the assessed organization to evaluate a sample (approximately 60) of requirement statements tested in the original i1 assessment in the prior year.  This reduces the amount of testing required in Year 2.  In Year 3, the organization would need to be assessed against the full 182 requirement statements. Risk-based r2 (2 year lifecycle) – Expanded Practices:  The r2 Assessment provides the highest level of assurance of the assessment types, focusing on a comprehensive risk-based specification of controls.  It has an expanded approach to risk management and compliance evaluation.  The comprehensiveness of control requirements, the depth of the controls review, and consistency of organizational oversight makes it a strong consideration for organizations with high-risk exposure. There are an average of 375 requirement statements for this assessment in Year 1 and an average of 40 requirement statements in Year 2 (Interim assessment).  These numbers can vary, depending on the risk profile of your organization when certifying against the framework.  A detailed questionnaire about your organization will determine the specific number of requirement statements in scope.